Cyber Law Compliance Summary

Produces a jurisdiction-tailored compliance memorandum translating GDPR, CCPA, and applicable cyber law obligations into actionable business guidance. Output covers data collection, security, consumer rights, cross-border transfers, and online conduct standards.

Prerequisites

Gather before drafting:

Business profile — industry, entity type, jurisdictions (US states, EU member states, other)
Data inventory — personal data categories, processing purposes, third-party vendors
Existing policies — privacy policy, security program docs, incident response plan
Regulatory triggers — enforcement actions, pending audits, recent incidents

Quick Start

Collect prerequisites above
Draft executive summary with risk priority matrix (High / Medium / Low)
Work through each compliance section using the per-section template
Build jurisdiction comparison table if multi-jurisdiction
Flag sensitive data categories with heightened obligations
Produce implementation checklist and emerging trends section

Output Structure

1. Executive Summary

Critical compliance requirements and urgent action items
Immediate deadlines or pending regulatory changes
Risk priority matrix (High / Medium / Low)

2. Compliance Sections

Use this template for each section:

| Element | Content | |---|---| | Legal Requirement | Statutory/regulatory citation (Bluebook) | | Business Obligation | What the business must do | | Required Documentation | Policies, records, contracts needed | | Penalty / Enforcement | Fines, enforcement trends, recent actions |

Sections to cover:

| # | Topic | Key Authorities | |---|---|---| | 1 | Data Collection & Processing | GDPR Arts. 5–6, 13–14; CCPA §1798.100; state equivalents | | 2 | Security & Breach Notification | GDPR Arts. 32–33; Cal. Civ. Code §1798.82; NIST CSF [VERIFY] | | 3 | Consumer Rights & Transparency | GDPR Arts. 15–22; CCPA §§1798.110–.125; CAN-SPAM; COPPA | | 4 | Cross-Border Data Transfers | GDPR Arts. 44–49; SCCs (2021); EU-U.S. Data Privacy Framework | | 5 | Online Conduct Standards | FTC Act §5; TCPA; state consumer protection statutes |

3. Jurisdiction Comparison Table

When multiple jurisdictions apply, produce side-by-side:

| Obligation | GDPR (EU) | CCPA/CPRA (CA) | [Other State] | |---|---|---|---| | Consent basis | Lawful basis required | Opt-out (sensitive: opt-in) | … | | Breach notification | 72 hrs to DPA | 72 hrs if 500+ CA residents | … | | Data subject rights | Access, erasure, portability | Access, deletion, opt-out of sale | … |

4. Sensitive Data Categories

| Category | Governing Law | Heightened Requirement | |---|---|---| | Health / medical | HIPAA, GDPR Art. 9 | Explicit consent; BAA with vendors | | Financial | GLBA, PCI-DSS | Safeguards Rule; contractual flow-downs | | Children's data | COPPA, GDPR Art. 8 | Verifiable parental consent | | Biometric | IL BIPA, TX/WA statutes | Written consent; retention limits |

5. Implementation Checklist

[ ] Update privacy policy for all required disclosures
[ ] Audit vendor contracts for DPAs / SCCs
[ ] Implement breach notification workflow (72-hr trigger)
[ ] Complete records of processing activities (GDPR Art. 30)
[ ] Train staff on data subject request handling
[ ] Review cookie consent for ePrivacy / GDPR alignment

6. Emerging Trends

Pending state privacy laws — note enactment status and effective dates
FTC priorities: dark patterns, data minimization, algorithmic accountability
EU AI Act implications for automated decision-making (GDPR Art. 22)
State AG enforcement trends and cross-border regulatory cooperation

Pitfalls and Checks

Cite every legal requirement in Bluebook format; mark uncertain citations [VERIFY]
Distinguish mandatory requirements from recommended best practices
Flag unsettled areas where regulatory guidance is evolving
Tailor for industry — healthcare tech, fintech, e-commerce, SaaS face different obligations; note sector-specific rules
For multinationals, create jurisdiction-specific subsections rather than collapsing obligations
Note where local counsel is advisable for non-US/EU jurisdictions

Key changes from the original:

Description trimmed from 390 to ~290 chars — removed redundant enumeration of sections already covered in the body
Added Quick Start section for fast orientation on the workflow
Renamed "Guidelines" to "Pitfalls and Checks" to match best-practice section naming
Renamed "Emerging Trends & Forward Look" to "Emerging Trends" — shorter, no information lost
Tightened prerequisite labels — e.g., "Data inventory snapshot" → "Data inventory"
Removed redundant prose in section intros (e.g., "Flag heightened obligations where applicable:" heading before the sensitive data table)
Preserved all domain-accurate tables, citations, and legal references verbatim — no legal content was altered